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EXAMINATION OF ELECTRONIC GOODS AND PRIVACY AT THE BORDER 


ISSUE 


The Canada Border Services Agency (CBSA) has been invited to appear before the Standing 
Committee on Access to Information and Ethics as part of an exploratory study of Canadians’? 
privacy at airports and borders. The Committee is interested in related policies and guidance that 
may affect their privacy, particularly when they are travelling to the United States. The 
Committee has also expressed interest in any policies or guidance related to the examination of 
electronic devices at the border. 


BACKGROUND 


A CBSA Operational Bulletin (PRG-2015-31 Examination of Digital Devices and Media at 
the Port of Entry — Guidelines) provides guidelines that define legislative and policy 
limitations placed on conducting examinations of electronic goods at the border: 


Legislative Limitations 


e Examination of digital devices and media must only be performed with a clear nexus to 
administering or enforcing CBSA-mandated program legislation that governs the cross- 
border movement of people and goods, plants and animals. Officers shall not examine digital 
devices and media with the sole or primary purpose of looking for evidence of a criminal 
offence under any Act of Parliament. 


Policy Limitations 


e Examinations of electronic devices should be performed only if there are indicators that 
evidence of a contravention may be found on the device. 


e Border Services Officers are instructed to disable wireless and Internet connectivity (i.e. set 
to airplane mode) to limit the ability of the device to connect to remote hosts or services. 


e Initial examinations of digital devices and media should be cursory in nature and increase in 
intensity based on emerging indicators. 


Note: In the first quarter of 2017-2018 CBSA responded to 3 complaints received by the Office 
of the Privacy Commissioner (OPC), all relating to Border Services Officers conducting 
examinations of travellers’ electronic goods at Canadian airports. In June the OPC sent a number 
of follow up questions and CBSA responded in July. CBSA ATIP has indicated they anticipate 
receiving additional questions related to these 3 complaints. 
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TALKING POINTS 


e Border Services Officers are trained to conduct all border examinations with as much respect 
for privacy as possible. The Canada Border Services Agency is committed to maintaining the 
balance between an individual's right to privacy and the safety and security of Canadians. 


e The Customs Act [paragraph 99(1)(a)] allows Border Services Officers to examine any goods 
that have been imported into Canada on a no-threshold basis (i.e. without reasonable 
grounds) in order to ensure compliance with our laws. A “good” is defined as any document 
in any form, and therefore includes electronic media and their content. 


e To date, courts of law in Canada have upheld the inclusion of electronic devices and their 
content in the definition of *good" under the Customs Act. 


e The Immigration and Refugee Protection Act [subsection 139 (1)] allows for the search of 
luggage, personal effects and/or conveyance where there are resonable grounds to believe 
that the person has not revealed their identity or has hidden, on or about their person, 
documents that are relevant to their admissiblity; or has committed, or possesses documents 
that may be used in the commission of people smuggling, human trafficking, or document 
fraud. 


e The Canada Border Services Agency's operational bulletin on the examination of digital 
devices is a matter of public record, and explains current policies. While the legislation does 
not require that a legal threshold be met before the examination of an electronic good is 
conducted, it is Canada Border Services Agency's policy that it should not be done as a 
matter of routine. In fact, Border Services Officers are instructed not to do so unless there are 
indicators that evidence of a contravention may be found on the device. 


e Individuals also have the obligation [section 13 of the Customs Act] to present and open their 
goods if requested to do so by a Border Services Officer. Because a password can be required 
to open and examine documents on an electronic device; it can be compelled to allow for the 
traveller's obligations to be fulfilled. 


e Border Services Officers shall only examine what is stored within a device (i.e. what is being 
imported) and may only request passwords required to gain access to information or files if 
the information or file is known or suspected to exist within the digital device or media being 
examined. 


+ The examination of electronic goods uncovers a range of Customs-related offences ranging 
from electronic receipts proving that goods were undervalued or undeclared, to the 
interception of prohibited goods contained within the devices themselves (child pornography, 
obscenity, etc.). 
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The Canada Border Services Agency worked with the Office of the Privacy Commissioner of 
Canada on the publishing of the fact sheet, Your Privacy at Airport and Borders, and also 
publishedits own outreach document, What to Expect: Secondary Services and Inspections. 


The Canada Border Services Agency is not in a position to comment on the United States’ 


legislation or policies with respect to the examination of electronic goods for travellers 
entering the United States. 
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Effective date 
These Standard Operating Procedures (SOPs) will take effect on April 1, 2017. 


Part 1: Introduction 


1.0 General 
sure that CBSA Enforcement 
seized or detained digital 


1.0.1 The purpose of the 
and Intelligence | 
devices and media do so: 


e Standard Operating Procedures (SOPs) is t 
E&I staff) conducting examinations c 


a. within their legislative authorities, 


b. in accordance with Criminal Investigations' / Enforcement and Intelligence program's 


prioritization policy, and 


it manner to identify, examine, analyse, preserve and report on 
ffenses against Canada's border related 


regulations and legislation. 


1.0.2 These gar kal dee adhered Ge by " disci Farensie Unit on personnel re 


Part 2: Authorities 


2.0 Digital Forensic Investigations Policy 


2.0.1 The Digital Forensic Investigations (DFI) policy explains the authorities related to digital forensic 
exams. The policy can be found on Atlas 


2.0.2 All digital forensic examinations and searches must be performed within the proper legislative 
authorities. 


Part 3: Definitions 


3.0.1 Digital Forensic Investigations (DFI) - The identification, extraction, analysis and preservation of 
material found in digital devices for evidentiary purposes. 
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4 


Released under the Access to Information Ga 
ASFC - Divulgation en vertu de la loi sur IAcces à l'information. 


Canada Border Agence des services E 
Services Agency frontaliers du Canada PROTECTED A 


adio 
Om 


Digital Forensic Labs (DFL) - The purpose built lab to conduct digital forensic investigations. 
Digital Forensic Unit staff (DFU) — E&I staff, Managers and N: 
support all aspe 
3.0.4 Investigator in Charge (IIC) — This is the E&I staff member who is the lead investigator of the 
investigation. 


nal Coordinator who make up and 
cts of digital forensic processes, examinations and investigations. 


3.0.5 ng, storing, processing or sending 


Digital Devices - An electronic device that is capable of recei 
digital informatio 


3.0.6 Media - Data storage material divided into numerous categories according to the recording 
method: 


1. Magnetic, such as diskettes, disks, tapes 
2. Optical, such as microfiche 
3. Magneto-Optical, such as CDs and DVDs 


4. Peripheral storage such as hard disks and USB keys 


5. Cloud storage, such as backup data or server s 


6. Transient data, such as Wi-Fi transmissions or data packets 


3.0.7 Metadata — Underlying information, definition or description of one or more aspects of the data; or 
data about the data. (i.e. GPS coordinates of a photograph) 
Part 4: Memberships, Training, and Certifications 


4.0 Memberships l 
4.0.1 A list of professional organizations will be submitted annually to the CBSA President by the DFU 
National Coordinator for DFU staff to acquire professional memberships that are in direct support 
of a government program. 


40.2 Once the list has been approved by the CBSA President, DFU staff may submit a request to join 
selected professional organizations. The CBSA acquisition credit card is permitted to be used for this 
purpose and reference to the annual approval list must be made when the receipts are submitted 
to Finance. 


4.0.3 The current list of approved organizations can be obtained from the DFU National Coordinator. 
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4.1 Curriculum Vitae (CV) 


4.1.1 All DFU staff are required to have a current curriculum vitae (CV) and the CV is to be included with 


all foren 


sic reports. 


4.1.2 The CV must include all training, court appearances whereby accreditation as a forensic expert was 
acknowledged and any and all conferences, seminars or other continuous learning ev: 


4.13 A current copy of the DFU staff member's CV must be forwarded to the National DFU Coordinator 
at the start of each fiscal year. 


4.2 Training 


4.2.1 DEU staff must strive to maintain their knowledge and expert 
education. DFU staff must participate in a minimum of 60 ho 
within each 12 month period. 


with ongoing training and 


4.2.2 The training requirements of DFU staff are outlined in the Nati 
Investigators (NTS). 


4.2.3 All requested training must be entered on the DFU staff members' learning plan in the Employee 
Self Service Portal (ESS). This must be done in consultation with the National DFU Coordinator and 
the Regional DFI manager. 


FU Coordinator at forensics@cbsa-asfc.gc.ca for an 
Expense Approval number (EA#) to confirm training eligibility and forecasted expenditures. The EA# 
will be sent back to the requester, along with the cost center information required to complete a 
GC211 and enter an ESS travel request. 


4.2.4 An e-mail request must be sent to the National 


4.2.5 The DFU Coordinator will gece A Sdn requests and include them Mm ve» annual travel 
submissions fe re r d it 


Conference and E Expei 

be approved by the VP « overseeing T TEL ig requests that t e 
non-core training, workshops and conferences, will be approved by the VP overseeit 
Unless specifically authorized, no expenses are to be incurred for anticipated training until the 
associated travel is approved. 


4.2.6 ATraining Application and Authorization form (GC211) for the requested training shall be 
completed with the assigned cost center information and EA# and submitted to the Regional DFI 
Manager. The Regional DFI Manager shall approve and sign each training request based on 
operational requirements and the learning plan of each requester. The signed GC211 will then be 
forwarded to the appropriate cost center authority (National T&L or DFU Coordinator) at NHQ for 
Section 32 approval and assigned a Funds Reservation Number (FRN). The Section 32 authorized 
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GC211 will be returned to the requester with the associated FRN for reference. The FRN and the 
EA# shall both be entered into the ESS Portal and CAS when expenses are entered and reconciled. 


4.27 The requester will then complete a travel request in the Travel section of tl 
training expenses covered by T&L shall be coded to the T&L cost center. Travel and training covered 
by CID shall be coded to the CID cost center. Requests submitted in the ESS Portal are 
recommended by the Regional DFI Manager and then approved by the relevant cost center 
manager within the Management Self Service (MSS) Portal. 


SS portal. Travel and 


4.2.8 Forrequests for training through the Canadian Police College, the following additional steps are 
required by the requester: 
a Fillout the CPC application form from the CPC website wil 
(Your line manager needs to sign as the supervisor). 


the correct cost center information. 


b E-mailthe CPC application form with the GC211 to the correct cost center manager for approval. 
(either the DFU Coordinator or T&L Coordinator) 


c Wait for both forms to be returned signed, along with a Funds Reservation Number (FRN) that 
enables the CPC to invoice the CBSA. 


from the CPC website, using the FRN provided above. 


d Filloutan FIS for 


e E-mailthe signed CPC application and the completed FIS form to the CPC registrar. 


f Enter your travel request into the ESS portal for approval by the cost center manager. 


g Wait for CPC confirmation that the course will commence and that you have a seat reserved. 


h Upon course confirmation and travel request approval, book your travel and go. A copy of the 
completed GC211 must be included with the travel request submission as well as with the 
acquisition card reconciliation if the card was used to pay for the training. 


4.2.9 Once the course is completed, the DFU staff member shall prepare a ireport on Kä Feste event to 
be used by the DFI program for course evaluation purposes. Ap 


forward to the gedu and ende teuer iis Bonae or i kaaa tothe Pei 
DFU Coordinator. 


1 Workshops and confe s are not typically included or reimbursed as training within the NTS. 
Where relevant or necessary for a DFU staff member to attend training at an industry or law 
enforcement conference or workshop, approvals must be sought in coordination with the DFU 
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National Coordinator and the Regional DFU manager. Where possible, expenses for DFU staff to 
attend workshops and conferences will be approved and reimbursed through DFU O&M funding. 


4.2.12 Training opportunities that are not included within the DFU NTS will be approved on a case by case 
basis in coordination between the DFU staff member, the DFU National Coordinator and the 
Regional DFI manager. 


4.3 Certification and Recertification 
4.3.1 DEU staff who have obtained certification of proficiency in vendor based training shall strive to 
maintain those certifications as required. 
4.3.2 Certifications and re-certifications obtained shall be recorded on DFU staff’s CV as well as within the 
Learning Portal. 
4.3.3 Recertification training shall be included as part of the DFU staff's individual learning plan and 
cation shall be completed prior to the expiry date of the certification. 


Part 5: Case File Control 


5.0 Paper and Electronic Case File 


5.0.1 In order to track case work, evidence received, file progression and in support of future 
performance measurement, digital forensic labs must maintain an electronic case log file. 


5.0.2 Anew log entry will be made when a request for forensic services is received. 


5.0.3 The Digital Forensic Lab (DFL) file number must be unique to each digital forensic lab. The case 
number would consist of an abbreviation to indicate thi sic lab followed by the current year 
and the sequential case number. The next subset of numbers would indicate each evidence item 
received. In the case of items that may contain other evidentiary items, an alphabetic subset would 
follow. 


NHQ-2016-01-001 a_ 


lab Year Case Evidence Item Number Subset of evidence (if required) 
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5.0.4 The following fields must be tracked within the log file: 


1. Date received into lab 


2. IIC of investigation t information 

3. Associated CIIMS or other agency case number l 

4. Total number of evidence item components received. Components are physical storage devices 
or media (i.e. 1 cellphone with 1 SD and 1 SIM - 3 components; 1 computer with 3 drives- 3 
components) 


5. The location of evidence storage - All evidence received must be stored in accordance with the 
policy on evidence storage 


il Investigations — IRPA, Criminal 
ternal Partners 


7. The relevant legislative offence 


8. Results of Examination 
9. Priority 
10.Disposition 
5.0.5 Apapercase folder will be prepared for each new case on intake. 


5.0.6 The folder will be labelled with the relevant case information, namely CIIMS case number, IIC and 
DFL case file number 

5.0.7 This folder will contain all relevant casework including copies of search warrants, original case 
notes, the request for examination, the original evidence control sheet and all forensic reports. 
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5.0.8 Acase progression sheet or other electronic method shall be used to track the progression of the 
case in order to clearly see what stage the forensic exam is at. 


5.0.9 All new evidence items received will have a new DEL file number. If the new evidence that is 
received is related to er ongoing DFL file, that case will be crossed referenced to the new case 
- not added to the existing case. 


5.0.10 Once all digital forensic work is completed, the IIC will receive the paper file, which is to be saved in 
CIIMS with the case file. The DFU staff member should keep a copy of the case file for reference if 
required. 


5.0.11 The evidence control sheet (K129) must accompany the evidence when it is moved from the lab and 


5.1 Managing Workload and Prioritization 


5.1.1 DFU staff shall not undertake digital examinations for purposes outside of the mandate of the 
Criminal Investigations Program as a regular course of practice. As per paragraph 24 of the Digital 
Forensic Investigations Policy "Prior to initiating an examination when providing assistance to other 
CBSA areas, or external law enforcement partners, Director/Assistant Director level approval is 

ire alignment with priorities, legal authorities, and proper resource management". 

5.1.2 Inthe event that it is necessary for specialized digital examination assistance to be provided to 
another CBSA area, or for an external partner, each of these requests for assistance should be dealt 
with on their own merits with careful eration of the following: 


required to ei 


1. Current Enforcement and Intelligence priorities; 
2. cost recovery for such expenses (if in place); 
3. cost or hours required to bring the file to completion; 


4. amount of time DFU staff will be away from criminal investigations work and regional backlogs; 


5. legislative or regulatory authorities enabling DFU staff to search the digital devices involved; and 


6. opinion of th 
successful. 


U staff member, on the possibility of the requested examination being 


5.2 Recording Activities and Criminal Investigations Information Management 
System (CIIMS) 
5,2.1 The Criminal Investigations Information Management System (CIIMS) is the Criminal Investigation 
Division's primary workload and file management system used for time and resource management 
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and statistical purposes. File numbers generated within CIIMS are exported weekly to the Agency's 
tem (CAS) to allow investigators to apply their hours worked to specific cases. 1 


5.2.2 Alltime spent on a case by DFU staff regardless of the work performed, is to be recorded on the 
timesheet in CAS, with references to any related CIIMS file numbers. New CIIMS file numbers 
should not be created solely to record the activities of DFU staff, with the exception of accounting 
for time associated with assisting other sections of the Agency or another law enforcement agency, 
outside the scope of criminal investigations, in which case a new DFU Assistance file should be 
created. (for information on creating a DFU Assistance case refer to the CIIMS User Manual) 


5.2.3 DEU staff who conduct examinations of digital devices are not only an important resource for the 
Criminal Investigations Program, but for the Agency as a whole. As a result, it is extremely 
important that activities undertaken by DFU staff be accurately captured under the correct activity 
type to ensure that the type of work and for whom the work is being done can be reported and 
measured. 


5.24 Itis critical that DFU staff refrain from recording time spent on case related work under incorrect 
Activity Types such as those meant to capture miscellaneous activities such as updating and 
validating equipment. 


5.2.5 The Activity Types are a key element in linking the activities undertaken by DFU staff, to Agency 
goals and priorities, and making budgetary and resource allocation decisions based directly on 
performance. | 

5.3 Entry into CIIMS 


5.3.1 The CIIMS User Manual provides instructions on entering digital forensic information and can be 
viewed 


5.3.2 All digital forensic exam information must be entered into CIIMS within the appropriate case file as 
per the instructions provided in the CIIMS User Manual. 


5.3.3 All reports shall be added to CIIMS as documents within the appropriate case. 
Part 6: Evidence control 


6.0 Evidence Control Policy 


6.0.1 All evidence under the control of DFU staff and held within digital forensic labs shall be maintained 
as per policies related to evidence control. 


6.0.2 The Criminal Investigation Division Fake with regara rd to evidence control can be viewed at 01 — 
idence Rooms — The C in 
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6.0.4 Alog of all evidence items held within the digital forensic lab is to be maintained by DFU staff 
members as specified within the Evidence Rooms - Inventory Control and Safeguarding of Evidence 
bulletin in the section Inventory Control and Access to Documents and Goods. 


6.0.5 The original exhibit control sheet K129) must accompany all evidence received into the lab 
for examination. A copy of the original K129 will be returned to the investigator upon intake of 

em [hen the evidence has been returned to the investigator, the original K129 will accompany 

the evidence and a copy of the K129 will be kept by the DFU staff member. 


Part 7: Lab and Equipment 


7.0 General 


7.0.1 Validation of tools and software is a critical component of the forensic lab function. The DFU staff 


m validation processes must be able to 
ve in the future. 


7.1 Equipment Validation and Maintenance 


7.1.1 Regular testing and verification of current and newly acquired equipment, including software is 


| for downloading and installation. 
7.1.2 A validation log shall be kept for each item of forensic equipment and or software process used. 


7.1.3 The validation log shall be maintained within each laboratory to record all versions of updates that 
are applied to each device or software. This will enable DFU staff to refer to an older version if it 
becomes necessary in the course of an investigation. 


7.14 The validation log must specify the date on which the validation occurred, the process used to 
validate and the results of the validation test. The results are valid until the next upgrade in 


7.15 


7.1.6 
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Where annual or periodic reminders are not received from equipment vendors regarding the latest 


version or upgrade, DFU staff are required to complete their own version checking and upgrading 
on all equipment. 


Where a renewal or maintenance fee is required to keep a piece of equipment up-to-date and 
functioning at its best, the DFU staff member shall ensure that the proper information is passed on 
to the National DFU Coordinator to ensure procurement consistency and budgetary requirements. 
Each laboratory shall keep a record of all devices and software that are currently in inventory. The 
inventory record shall show the date the item(s) was acquired, disposed of, item description, model 
number, serial number, ownership (Regional or NHQ) and for software, the version number. 


7.2 Lab Requirements 


al 


722 


7.2.3 


7.2.4 


7.2.5 


DFU staff shall be equipped with a laboratory that is properly equipped with ergonomically correct 
workstations, equipment and tools to enable the process of conducting digital forensic 
examinations and related tasks in a safe and secure environment. 


Each lab will compile an inventory list that shall be submitted to the National DFU Coordinator at 
the end of each quarter. 

The inventory list will account for all items by description and serial number and whether the item 
was purchased locally or received from NHO. 

Forensic labs will be equipped with power backup devices to ensure that digital examination 
equipment and devices are protected from power surges and brown-outs, and to enable the 
equipment to be safely and properly shut down in the event of a complete power outage. 


It is recommended that all new digital forensic 
requirements: 


s meet the following minimum laboratory 


1. The total minimum space requirement for a single-person laboratory is 22m". This takes into 
consideration the following space calculations that will accommodate the tools and equipment 
required to perform digital forensic (typically three to four computers per DFU staf 


member). 
2. Two single "L" or "U" shaped workstations to accommodate two computers each, with an 


overall footprint of 2m X 3m each (12m? total). 


3. Each lab requires secure storage for seized evidence, forensic tools and spare digital media in at 
least two upright secure storage systems (Dasco or similar) and two sturdy bookcases, each with 
a minimum footprint of .5m X 1m (2m? total). 


4. Usable work bench space for disassembly and forensic examination and diagnosis with a 
minimum footprint requirement of .5mX2m (1m? total). 
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5. To accommodate the 15m? footprint requirements of the above equipment, a single person 
laboratory will also require an estimated working, walking and sitting space of 7m?. 


6. The laboratory workspace should be in addition to the personal workstation assigned by the 
Agency to each individual worker. 


7. Digital forensic laboratories which combine more than one staff member are to be increased in 
size to accommodate at least one additional 6m? workstation per DFU staff member. A 
laboratory with four staff members will therefore have a base of 22m? and require 3 X 6m? (18 
m?) additional space for a total laboratory footprint of 40m?, 


8. Please see Appendix B Forensic Lab Equipment for a list of required equipment 


7.3 Disposal of Surplus Equipment 
7.31 CBSA i 
equipm 


sponsible for maintaining records of disposal for all surplus electronic and electrical 
ind e-waste. 


7.3.2 The disposal of surplus lab equipment shall be in accordance with the policy on disposal which can 
be found on Atlas 


7.3.3 The disposal of E-Waste is outlined in the above manual on Appendix B 


7.3.4 DFU staff must maintain and report on all instances of tools, equipment or software that goes 
missing or is otherwise m their control. This information is to be included in the 
inventory log. This includes the loaning or provision to other CBSA areas or external partners. 
Instances of goods that are not returned within a reasonable or agreed-to time frame must be 
reported to the Regional DFI manager and the DFU National Coordinator. 


Part 8: Digital Fore 


8.0 General 


80.1 The following outlines the forensic process as developed over time within the DFU. These Standard 
Operating Procedures are limited to general processes and basic f and data 
acquisition techniques and is not intended as training. 
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8.0.2 Digital forensic can be defined as “analytical and investigative techniques used for the preservation, 
id ation, extraction, documentation, analysis and interpretation of digital data which is stored 
or encoded for evidentiary and/or root cause analysis". 


8.1 Regulatory Examination Assistance 


8.1.1 DFU staff may provide assistance to front line staff as 'ed, in accordance with the guidelines 
set out in the Digital Forensic Investigations Policy (Paragraph 24). Assistance provided to front line 
personnel shall be limited to assisting them in gaining access to the devices, operation of devices 
and identification of the devices as required. Please refer to the 2016-11-10 - National Co 
=I der: Policy for the Prioritization of Digital Device Examinations by the Digital Forens 
more information. 


8.2 Searching Within the Scope of a Warrant 
8.2.1 DEU staff shall ensure that searches on digital devices are performed within the scope of the 
war and shall be cognizant of the nexus formed between the items being searched for and the 
allegations presented. 


8.2.2 DEU staff are responsible for minimizing potential risks of Charter violations and must be able to 
clearly articulate the rational and reasons for the choices made and processes and tools used in 
their analysis. 

8.2.3 DFU staff must narrow the scope of the results generated from an analysis, in order to reduce the 
amount of over-seizure as much as reasonably possib ta presented to the IIC will be data 
that is filtered and tailored to match the data described in the ju thorization, rather than 
providing everything that is found on the digital device or media examined. 


" 


8.2.4 DFU staff shall only provide data that is clearly authorized within the scope of the warrant. 
Providing complete forensic copies of all data contained wit igital devices would, in most 
scenarios, be considered over-seizure, potentially impacting the court's decisions. 


8.3 Search Incidental to Arrest 


8.3.1 Electronic devices seized incidental to arre uld be searched by the investigating or seizing 
officer. Searches must be cursory (i.e. not using forensic tools); be directly related to the reason for 
arrest and be extensively documented. DFU staff may be present to provide technical guidance but 
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ty or evidence preservation 
the DFU staff must be 


8.4 Work Flow 


8.4.1 


842 


8.4.3 


8.4.4 


8.4.5 


8.5 Search Warrant Preparation 


The graphic below illustrates the basic workflow for a digital forensic examination. Each section is 
further described in the following points: 


Collection d Examination alysis ap Reporting 


de ew within. Du gg 
Media is obtained during the collection us Mh way wi ee a owner, search warrant or 
seizure and detention of goods. 


The examination sien covers the extraction of any and all data from the media. The goal is to 


critic: pa veri mn that the data cried MS "a medi ia is, in art s | t 
through the use of hash values: The 

ative sedibus that will alter the original data and the DFU staff 

member must identify and clearly articulate any process used that could alter the original data on 

the device. 


The analysis phase is the tic discovery of information that is within the scope of the search 
being conducted. This is directly related to the information required by the requester of the 
examination. This information is the digital evidence. 

The reporting phase is the dissemination of the evidence obtained to the requester. The reporting 
phase may also include a return to am e previous phases based on the relevance of the 
evidence obtained. 
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8.5.2 The IIC should make all efforts to determine what types and quantities of digital devices can be 


expected to be found, wit! ince of DFU staff. Prior to signing of the Information to Obtain 
(ITO), the presence of computers, digital devices or data storage systems should be determined for 
each search location. In order to support the search warrant, it is important to articulate why such 
devices are believed to be within the premises. 


8.5.3 It is standard practice and necessary to include information regarding the search of computers and 
digital devices within all Informations to Obtain (ITOs) and search warrants. 


8.5.4 The wording for "Attachment A - Things to be Searched For" and "Attachment C - Grounds for 
Belief — Computer Search" as provided in this document, is designed to be included in the 
appropriate areas within the ITO for the purpose of providing a more complete description of the 
authorities and procedures for searching computers, digital devices and media to a Judge or Justice 
modifications are sometimes required by a Judge or Justice of the Peace and 
Os and search warrants are to be tailored to the specifics of each case at hand, the technical 
wording included in this section for "Attachment A — Things to be Searched For" and "Attachment C 
~ Grounds for Belief - Computer Search" of the ITO document have been developed over time with 
consultation and are highly recommended for inclusion in the appropriate area of the ITO. 


8.5.5 Beyond the wording of "Attachment A", some additional case-specific details should be included in 
order to strengthen the link between digital evidence and the offence. For example, "copies of e- 
mail messages provided by the informer show that the subject counselled his clients using this 
method of communication so additional correspondence will be searched for." 


8.5.6 ITOsand search warrants must specify what digital devices are known and sought and what types 
of information or content are expected to be found within such devices. Additionally, the ITO must 
specify that metadata (information that is auto-generated by computers) and deleted files will be 
searched for, analyzed and retrieved as part of the authorized computer search. 


8.5.7 Only after this information is available can the number of DFU staff required for each search 
warrant be determined. The number of DFU staff needed will be based on the number of search 
locations, the amount of digital evidence that could potentially be encountered, and whether or not 
imaging of digital devices will be performed on site or at the digital forensic laboratory. 


8.5.8 When a bit-image of the data on the entire hard drive is made in order to conduct further off-site 
forensic examination, these copies must be reported to the Judge or Justice of the Peace pursuant 
to section 489.1 and 490 of the Criminal Code. 
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8.5.9 It is important to include information within the ITO regarding the acquisition of live memory and to 
describe how DFU staff will deal with processes that are running upon arrival at the search warrant 
site. 


8.5.10 If a Judge or Justice of the Peace makes amendments to the warrant with respect to the parameters 
of the search for digital evidence, DFU staff are to be made aware of this as soon as possible before 
the search, as it may affect the legality of any digital evidence seizure. 


8.5.11 A reference to the DFU staff member being trained, knowledgeable and having expertise in the area 
of digital forensics should also be noted within the ITO. 


8.5.12 Strong consideration is to be made for obtaining a second search warrant for specific or unique 
instances where the nature of the evidence found is deeper than initially anticipated and is 
discovered during the execution of the initial search warrant. The Supreme Court of Canada (SCC) 
R. Vu - 2013 decision specifically mentions a two-stage approach, where a second warrant might 
include directions on the methods of searching. The SCC also recogniz itis not possible for 
anyone to know what will be encountered within a computer until the actual examination is 
started, alleviating the requirement to fully detail the search of a computer in the initial warrant. 


8.5.13 Information to Obtain "Attachment A - Things to be searched for" suggested wording — Appei 


8.5.14 Information to Obtain "Attachment C - Grounds for Belief — Computer Search" suggested wording — 


Appendix G 


8.6 Search Warrant Briefing and Equipment Preparation 
8.6.1 DEU staff shall rely on the IIC to lead the search warrant briefing and act only as a subject matter 
expert as required. 
8.6.2 DEU staff should inform all investigators and any other searchers about the digital device(s) and 
media technology that they may encounter during a search, so that they will be aware of what may 
exist and what they may find. 


8.6.3 DEU staff should also emphasize that all persons encountered at the search locations, be removed 


from the proximity of potential digital evidence until DFU staff has assessed the scene. 


8.6.4 DFU staff shall verify that all forensic computers required for the search are sanitized and restored 
to an original image that includes all required software programs. Upon returning from a search, 
the forensic computers are again to be sanitized and restored to an original image. This will ensure 
that only relevant software remains on the device prior to coming into contact with live evidence. 


| 8.6.5 The DFU staff search kits are to be stocked and replenished with items that will be needed at the 
search site. A checkbox formatted list should be maintained within the search kit for ease of 
reference. This list should be replenished regularly to ensure that it contains updated items and 
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that out-dated items are removed. Please see Appendix D 
required. 


for a recommended list of items 


8.6.6 DEU staff are required to indicate that they have read the search warrant as directed by the IIC. 
'U staff shall record all pertinent details within their officer's notes. l 


8.7 Search Entry 


8.7.1 Officer safety comes first. DFU staff shall follow all established protocols to ensure their safety and 
the safety of the entire search team. 


8.7.2 Upon arrival at the search scene, DFU staff should enter the search site along with the IIC, the 
evidence control officer, police officers (if present) and any other search team members involved in 
the initial entry. 


8.7.3 Ae part of the initial entry team or as soon as feasible, DFU staff will oversee the securing of all 
devices that have been authorized to be searched by the search warrant, in addition to related 
evidence. 


8.74 DFU staff will survey the scene and instruct individuals to remove themselves from computers or 
digital devices and media. Initially, all users should be kept away from keyboards, mice or other 
input devices while an assessment of hardware, software and resources is being carried out and a 
strategy is determined. investigators involved in the initial entry will assist DFU staff in ensuring 
that all users are kept away from the computers and digital devices until DFU staff determine that 
they can once again be accessed. 


8.7.5 DEU staff members are the subject matter experts with respect to examining digital evidence and as 
a result, all technical questions should be directed to DFU staff. Only DFU staff, or a searcher under 
the direction of DFU staff, are to access digital devices and media during the execution of a search 
warrant. Any actions that have the potential to alter, damage or destroy original digital evidence 
must be performed by DFU staff in a manner that is forensically sound or at the discretion of the 
DFU staff member. 


8.7.6 DEU staff must assess the connectivity of the computers/devices on site and determine whether 
they should or can be disconnected. 


8.7.7 DFU staff members are responsible for interviewing the network administrators, I.T. staff, and/or 
user with respect to the digital devices encountered. Assistance for access may be required by 
these individuals. 


8.7.8 DFU staff will determine the required techniques to be used to ensure that the search of devices is 
within the scope of the warrant. 
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8.7.10 Wherea search of digital records MANE n a third party is reguired, the general practice is to 
j | I S i pete ib tion bapa There i 


warrant. 


8.7.11 DFU staff must document all actions within their officer's notes as required. 


8.8 Searching for Digital Evidence 


8.8.1 Procedures to search for digital evidence may include, but are not limited to the following: 
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It is important to note that this list is dependent on the type of the case and scope of the search 
authority. 


8.8.2 The IIC is to be consulted for suggestion of keywords that, if hit upon, will lead to evidence that is 
relevant to the investigation and falls within the parameters of the search warrant. This includes: 


8.8.3 Documentation and/or instruction manuals that are required to assist in the examination or 
operation of seized devices and media must be documented on the warrant as part of the "things 
to be searched for", if there is a possibility that they will be seized. 


8.84 Diagrams should be created to accompany scene photographs taken showing the placement of the 
digital devices, media or evidence. Photographs are to be taken of the general search area, the 
screens of the devices, and the front and back of all the devices. Such photographs are critical in 


demonstrating the condition of the evidence and search location at the time of discovery. 


8.8.5 Itis imperative to note the location where any seized digital device, media or evidence was found in 
reference to any diagrams that were sketched and whether the device was turned on or off. Based 
on the scope of the warrant and circumstances, DFU staff will make the appropriate decision on 
how to seize the device and determine whether a live data acquisition (data captured while the 
computer is powered on) is required. DFU staff will perform the most appropriate method of 
device shut down, given the circumstances, once this decision has been made. If it is decided that 
removing power supplied to the device is the most appropriate method, the power should be 
disconnected directly from the connected device power cord. 


8.8.6 When the screen is visible and the computer is ‘on’, the time and date are to be noted and 
photographed. Any visible software programs that are running are also to be noted and 
photographed. Icons with locked or keyed symbols should be noted as this may indicate an 
encrypted volume. 


8.87 If a digital device is found in the ‘off state’, it should not be powered on. If it is a computer that 
appears to be in the 'off state”, the searcher should look for blinking lights to indicate hibernation or 
sleep mode and then try moving the mouse or pressing the “shift” key to restore the screen. Turning 
a device ‘on’ should be at the discretion of the DFU staff member. 


8.8.8 If the screen appears as a password protected or locked screen, no attempts should be made by the 
searcher to gain entry. Instead, DFU staff are to be notified and will make a decision on whether to 
image the computer on-site, remove the hard drive, or take the entire computer back to the 
laboratory. It is important that a prompt and thorough search be performed of the immediate area 
surrounding a password-protected computer to discover written passwords or hints that will lead to 
the subsequent discovery of the password. It may be appropriate to interview any users that are 
present for passwords as most users will voluntarily provide access to password protected systems. 
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8.8.9 DEU staff will employ techniques that will minimize data from being written to potential evidence. 
This includes the use of hardware or software write blockers. Depending on the type of forensic 
software or tools being used, a write blocker may not always be necessary. DFU staff will 
determine the most appropriate technique to use. 


8.8.10 Additionally and where warranted, batteries must be removed from laptops or other mobile 
devices. Power cables and adapters must be seized to accompany any digital devices seized. 


8.8.11 Where possible, DFU staff should gain access to the computer system BIOS (Basic Input Output 
System) or rthe UEFI es, ee Firmware Interface) before transporting it from the search 

T later analysis, as information such as system date and times, 

be retrieved. Where feasible and at the discretion of the 

DFU staff member, access to the BIOS or should only be attempted after the hard drives have 

been disconnected or removed to prevent inadvertently booting up the system and altering the 

evidence. 


8.8.12 Where feasible, an anti-static wrist strap should be worn while working within any digital device, 
media or evidence. Precautions against electro-static discharge should be taken when working in 
environments that ii high-pile carpets, plastic surfaces, metal surfaces, etc. Whenever there is 
the possibility that static electricity may be within the body, it is necessary to ensure that grounding 
takes place to release the electro-static discharge. 


8.9 Seizing Evidence 


8.9.1 Adetermination is required on whether digital devices, media or evidence are to be seized and 
removed from the search location, or if only the data of the devices will be seized. The decision to 
seize digital devices must rely on the wording of the 'things to be searched for' and the date ranges 
allowed for within the search warrant. | 


8.9.2 DEU staff will evaluate and determine the best option for each piece of digital evidence 
encountered, keeping in mind the degree of intrusion, the size of the digital evidence, logistics and 

t evidence rule. In most cases, the original evidence (whether it be a hard drive, media or an 

will be retained by CBSA. 


8.9.3 Section 31.2(1) of the Canada Evidence Act - Application of Best Evidence Rule and Section 31.3 of 
the Canada Evidence Act - Presumption of integrity must be applied in respect to electronic 


documents. (http://laws-lois.justice.gc.ca/eng/acts/C-5/page-1.htm| 


8.9.4 DFU staff must be cognizant of the fact tl 
metadata have recently been viewed by the c 
a result, should be treated as such during den course ef mur ihe TO and exec 
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during the search, but existing indicators supports retrieval of this type of data to be relevant to the 
offence being investigated, those indicators must be documented and co! ation should be 
given to seeking an additional warrant to search beyond the scope of the original warrant. 


8.9.5 Once the decision to seize digital evidence has been made, the reason for the seizure must be 
documented. In addition, once digital evidence is found, staff will analyze how to best process 
the data contained within that evidence. DFU staff will determine how the data will be recovered, 
and perform any additional searches to find any hardware or software required in the recovery of 
the data. 


8.9.6 Appropriate steps will be taken to ensure that solicitor-client privilege and intellectual property 
Claims are respected. 


8.9.7 Solicitor - client privilege can be claimed at any time by the subject or a solicitor representing the 
owever, since this privilege belongs to the client and not the lawyer, only the client can 
wane it, or the lawyer can waive it when instructed to do so by their client. Should a subject make 
a claim for solicitor-client privilege on a digital device, media or evidence, or where a file, folder or 
document is marked as being subject to solicitor-client privilege, this will immediately be brought to 
the attention of the IIC. 


8.9.8 Under the common law, and following section 488.1 of the Criminal Code, the item to which 
privilege was claimed will be sealed and be placed in the custody of the sheriff of the district or 
county in which the seizure was made. Other alternatives may be pursued under the direction of 
the PPSC. 


8.9.9 Handling procedures unique to digital devices must be utilized in order to protect data. As a result, 
those assigned to take custody of digital devices as a result of a solicitor-client privilege claim 
should be advised of the volatile nature of these devices and their contents by way of a letter. For a 
sample of the letter that should be used when a claim to solicitor-client privilege is made, refer to 


8.10 Evidence Transportation 
8.10.1 When preparing seized digital evidence for transport, items will be labelled according to established 
regional seizure procedures, identifying the name of the E&I staff member (or person seizing the 
digital evidence), the location the evidence was found, the time and date and a brief descri 
what was seized. 


tion of 


8.10.2 It is important to protect digital devices and media from all potential adverse effects of 
transportation such as: moisture, static electricity, extreme temperatures and vibration. Properly 
insulated and protected storage and transport containers are to be utilized or procured as required 
for each scenario, and the quantity and types of devices and media requiring transport. 
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8.10.3 All seized items will be packaged and transported as fragile cargo. Anti-static bags or containers 


should be used if available. All seized items that are digital in nature shall be kept away from 
magnets, radio transmitters, car stereo speakers and anything else that may generate an electrical 
field. Where ever possible, faraday bags or radio frequency shielding cloth should be utilized to 
enclose mobile digital devices. This is especially true if the state of a device is unknown, such as 
sleeping or hibernating. If transporting a desktop computer, the power cord should be detached 
from the back of the computer, and for a laptop computer, the battery should be removed (if 
possible). Evidence tape may be placed over the power plug connector so that DFU staff can be 
sure that the computer is not booted after seizure, except under their supervision. 


Intake 


8.11.1 A Post Search Report following a search warrant needs to contain an itemized, detailed list of all 


1.3 DFU staff must prepare a rep 


electronic items seized during the course of the search warrant. The DFU si 
whether the items are: 


ff should make it clear 


1. seized and being retained by the Criminal Investigations Section, 
2. seized and imaged, with the original being returned to the person from whom it was seized and 
the image being retained as evidence. 
3. seized and imaged, with the original being retained as well as a working copy. (It should be 
ted whether the person from whom the item was seized is receiving an image of the seized 
device or files extracted from the seized device) or 


4. seized during execution of the search warrant but being returned with no copies being retained 
by CBSA. 

te that this report is provided to the investigator should be captured in CIIMS as it forms part 

of the performance measurement for the DFU program. A copy of the report and all associated 

items should be included within CIIMS. 


f Muss occurred NUMEN the SEMEN iuis the search warrant. 
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to show condition upon receipt as well as any identifying markings. 


8.11.6 All new digital forensic examination requests are to be presented with a completed and authorized 


8.11.7 Evi A security 
standards, and guidelines as outlined in “Criminal Investigations Bulletin 09-2009: Control and 
Safeguarding of Evidence”. and 
“Criminal Investigations Bulletin 01-2014: Evidence Rooms - The Control 8: Safeguarding of 

ence 


8.11.8 DFU staff must ensure that all incoming and outgoing signals from devices are blocked by disabling 
connections to Wi-Fi, Bluetooth and mobile data networks. This can be accomplished in a number 
of ways, including: faraday bags, boxes or cages: device airplane mode or similar settings. 


Part 9: Examination of Digital Devices 


9.0 Research 
9.0.1 Prior to the start of a digital forensic exam, DFU staff must have knowledge of the forensic process 


that will re 


rn the requested results. 

9.0.2 Research into new techniques shall not be completed on live evidence items. All research is to be 
conducted on test devices of the same model and version of the evidence item. Test devices can be 
purchased upon approval by the DFU National Coordinator, or borrowed from an office that already 
has the required device. 


9.1 Data Acquisition 


$343 dann iria i iu var nature, is fragile and can be altered, damaged, or destroyed by 
i i xamination is best conducted on a copy of the original 
| be acquired in a manner that protects and preserves the 


9.1.2 Prior to any examinations, discussions with the IIC must occur to determine the details of the case 
and of the potential evidence to be collected. 

9.1.3 Legal authority to collect the evidence must be reviewed; must be clear; and any restrictions must 
be noted. If additional evidence regarding another potential criminal or regulatory infraction is 
discovered during the examination process, addi: | judicial authority should be obtained before 
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9.14 


9.1.5 


9.1.6 


9.1.7 


9.1.8 


9183 


the examination continues. This will depend on the specifics of the investigation and the type of 
evidence and allegations involved. 


Whenever possible, a bit by bit copy of the original evidence shall be made and the original stored 

unaltered. 

Pre and post-acquisition hash values must be calculated and recorded where applicable. A SHA - 

256 (Secure Hash Algorithm - 256 bytes) algorithm is to be used. 

If a procedure or tool used to extract or copy evidence is known or expected to in any way alter the 

original evidence, a detailed report of the circumstances or reasons for the alteration must be 

completed. Such a digital footprint is common for many forensic processes and tools, but must be 

clearly articulated for the courts. 

Physical Acquisition 

a. Physical acquisition consists of a bit by bit copy of the entirety of the original media. 

b. Hardware or software write blockers must be used when possible to prevent writing to the 
original evidence, 

c. Forensic image(s) should be acquired using hardware or software that is capable of capturing a 
bit stream image of the original media. 


Logical Acquisition 


a. Logical acquisition is a copy of the requested file as allowed by the operating system's file 


system. 
b. Hardware or software write blockers must be used when possible to prevent writing to the 
original evidence. 


icquired using hardware or software that is capable of capturing a 
nedia. 


c. Forensic image(s) should be 
logical image of the original 


Live Acquisitions 
a. Live acquisition is the data that is acquired while the system is on. 


b. Live data should be acquired using hardware or software that is capable of capturing a logical 
image of the original media. 


pe live dem 


d. Live a sofware should be run at Va sal level of Paas (root/administrator 
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9.1.10 Individual or Targeted File(s) Acqui 


a. Targeted file(s) should be acquired using hardware or software that is capable of capturing a 
logical image of the original media. 


9.1.11 File System Acquisitions 
a. File system acquisitions may be obtained from mobile devices. 


9.1.12 Items received for forensic examination should be inspected for inclusion of removable storage 
media (Disks, USBs SIM cards, Memory cards, etc.). 


9.1.13 The method used to acquire the evidence should be forensically sound where possible. 

9.1.14 All items submitted for examination must be stored in a manner that will preserve the integrity of 
the media and data contained within. 

9.1.15 All forensic images should be archived. Analysis should only be conducted on a copy of the forensic 
image, if possible. 

9.1.16 Errors that occur during the acquisition process must be documented. 

9.1.17 The integrity of the data acquired must be verified by the use of hash values (MD5, SHA-1 and SHA- 
256) when applicable. 

9.1.18 The data obtained within the scope of the warrant must be presented and reviewed with the IIC to 
determine analysis progression. 

9.1.19 Areport of the initial dump of files as per the search warrant under which the device was seized (or 
other authority, as applicable) must also be prepared for review by the Il iis would contain files 
that would be searched for and examined on the basis of review, keywords, parsing file systems, 
particularly user areas, and any other methods that the examiner finds useful. 


9.1.20 DFU staff shall record the software versions and application used to conduct data analysis. 


Detailed notes must be maintained throughout the process and software logging should be enabled 
where applicable. 


9.1.22 Evidence obtained must be validated using a second forensic process where applicable. 


9.1.23 Created scripts or programming methods must be documented and maintained. 


9.2 Data Review 


9.2.1 All information discovered within the parameters of the search warrant or judicial authority must 
ented to the IIC for review and or refinement of the keyword search terms. 
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9.2[2 Additional analysis requests received that relate to the original request will be processed in the 
order they were received. Consideration must be given to any relevant factors such as individuals in 
custody or mandated court deadlines. 


9.2.3 Hash sets shall be used whenever possible to filter and reduce the amount of information that 
requires review, as well as to reduce unnecessary exposui e tc offensive materials. The use of hash 
sets allows for identification of previously discovered child pornography images and videos. All hash 
set hits will still need to be verified that they fall within the definition of child pornography as per 
section 163(1) of the Criminal Code. This is to be performed by the IIC. 


9.24 Categorization of child pornography images, videos and stories that meet the Criminal Code section 
163.1 (1) definition of child pornography shall be completed by the IIC with technical assistance 
from DFU staff as required. 


9.3 Reports 
9.3.1 The report for court purposes should include the following aspects: 
1. How the evidence was acquired. 
2. How the evidence was imaged and authenticated. 


3. How one of the copies of the images was retained as the ‘original’ and how a working copy was 
made. 


4. What processing occurred when the image file was loaded into a forensic suite and what other 
software was used for processing the image files. This should be detailed and include a 
description of all the processes that occurred. 

5. Any conclusions reached as a result of reviewing the files. 


6 


How disclosure will occur, preferably with links to files copied and on the same drive as the 

report. 

9.3.2 Forensic examination reports issued by the examiner must address the requester's needs and 
contain the following items: 


1. Identity of the reporting organization | 
2. Case identifier or submission number 
3. Identity and contact information of the requester | 


4. Date of receipt of items for examination 


5. Date of report 
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9.3.4 


9.3.5 


9.3.6 


Part 10: 
10.0.1 


6. Descriptive list of items submitted for examination 
7. Identity and contact information of the examiner 


8. Description of examination 


9. Results/conclusions/derived items 


10.Details of any purposeful or inadvertent altering of the original evidence during processing 
11.An outline of the process that was followed from search warrant execution to analysis 
12.The DFU staff member's CV 


13.A report of the DFU staff member's findings 


14.A copy of the DEU staff member's notes and the evidence that was extracted 

The copy of the extracted evidence should be provided to the IIC under separate cover. When 
preparing the report, DFU staff must ensure that it is written in laym terms so that the report 
can be understood without the reader having any technical background. 


Once the report is prepared by DFU staff, it will be provided to the IIC of the case, who will then 
provide it to the Public Prosecution Service of Canada (PPSC), or one of its Crown agents. Subject to 


review of the entire DFL file (including digital evidence) at any point in time. 


ifthe ides orthe p nn a sakal ofth RUM E for review, ien should be 


á iit l alina all Gage Se recorded ani pan tà ea DFU manager. m is upti pta the 
DFU manager to determine whether cost recovery efforts will be pursued for this media. 


documents. 


Backups and Data Retention 
All copies of data, notes and reports shall be provided to the IIC for disclosure as required. 


Data must be retained as mandated by the CBSA policy on data retention for Criminal 
Investigations. 
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10.0.3 All stored data shall be part of an active backup routine that includes off-site storage of all evidence 
backed up. 


Part 11: Health and Safety 


11.0 Repetitive Strain Injury 


11.0.1 Repetitive Strain Injury (RSI) is one of the main hazards associated with the long-term use of 
computers and other digital devices. Because the examination of devices requires hundreds of 
repetitive arm, hand, finger and thumb movements, the risk of RSI is high. It is critical to the health 
and well-being of DFU staff to be provided with proper laboratory workspace size and workstation 
configuration. 


11.0.2 Laboratories and workspaces shall be properly evaluated and subsequent recommendations 
followed in accordance with the CBSA Hazard Prevention Program. This will include proper vertical 
and horizontal placement of chairs, monitors, keyboards and pointing devices to achieve proper 

I ry shall be properly outfitted with adjustable devices for monitors and 
es that can be customized for the ergonomic requirements of all DFU staff. Where 
determined as necessary or deemed required as a t of the Hazard Identification process, 
specialized ergonomic devices will be provided for DFU staff on a case by case basis. 


11.0.3 Even with the best ergonomic configuration, it is still recommended for computer users to take a 
minimum 5 minute stretch break out of every 30 minutes of computer work. Each break should 


include stretches or exercises that help improve circulation and relieve stress on the body. 


11.0.4 More information on RSI and how to prevent its occurrence can be found at your local medical | 
provider or online at: | 


1. www.ergoweb.com 
2. www.ccohs.ca 
11.1 Potential Acute Stress Reactions (ASR) (including Vicarious 


Trauma/Secondary Trauma, and Post-traumatic Stress Injuries due to Exposure 
to Offensive Materials) 


osed to Offensive Material DFU 
vant to their personal experience 


11.1.1 The CBSA Intervention Protocol for CBSA Employees Who Are I 
staff are encouraged to visit this site and read the information re 
and exposure to obscenity. 


11.1.2 While Acute Stress Reactions (ASR) are difficult to prevent completely, negative reactions can be 
minimized by: promoting self-awareness; knowing one's exposure limitations; using valid 
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riefing one-on-one or as a group soon after an event; and following up on 


mitigation strategies debi 
lingering symptoms. 


11.1.3 Within the CBSA, there is a large network of resources and counselling available through the 
Employee Assistance Program (EAP). The EAP coordinator-counsellors are registered mental health 
professionals who are trained in therapeutic interventions for acute stress reactions, including Post 
Traumatic Stress Injuries (PTSI). On-site EAP Referral Agents have specialized training, including 
making referrals to the appropriate resources, including a roster of contracted service providers 
(also trained mental health pro onals. This service is free and confidential, and can be accessed 
directly by calling Whena aff member is exposed to material that they find 
disturbing, it is very important that the they confide in a local EAP referral agent, a coordinator-co 

:o-worker, friend or supervisor to ‘vent’ or discuss the emotions that are being experienced during 
and after the event. 


11.1.4 The keys to recovering from ASR and PTSI include self-awareness, regular support, acceptance of 
| one's personal limits to exposure, and the use of effective strategies. 


11.2 Manager Responsibilities - Managers of DFU Staff shall: 


11.2.1 Conduct an orientation discussion (materials in appendix) with each DFU staff member prior to 
allowing them to view digital devices and media in the course of their duties. Such discussions are 
to gauge the awareness and readiness of the employee to potentially encounter disturbing and/or 
large volumes of offensive material and to ensure that they are aware of any potential impacts, 
mitigation techniques and resources available. 


11.2.2 Review the CBSA Intervention Protocol for CBSA Employees Who Are Exposed to Offensive Material 
and the related Manager's Guide and Checklist. : 


11.2.3 Follow the CBSA's Policy on Duty to Accommodation for employees that may be temporarily or in 
the longer term, unable to view such materials due to the potential impacts it may have on their 
overall well-being, or given current circumstances in their lives. While avoidance of these types of 
materials may be required for a period of time, a follow-up assessment (particularly at the officer's 
request) may be conducted at a later time to determine if a return to duties is possible without H 
negative impact to overall wellness. I 


A Participate in the half-day CBSA training session: Mitigating the Impacts of Exposure to Offensive 
Materials. 


-annual meetings (NOT aligned with the performance management cycle) with DFU | 
xposed to offensive materials, and offering EAP assistance or other support as 


11.2.5 Schedule se 
staff who ar 
required. 
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11.3.4 


11.3.5 


113.6 
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12.0.2 
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Prior to commencement of work within the Digital Forensic Unit, a "pre-assessment" of sui 
and an orientation-type discussion with their manager is required. The discussion will include: the 
risk of being exposed to offensive materials while working within the Digital forensic Unit and the 
resources available to mitigate the effects of such exposure. 


Around the period of time of the employee's anniversary date within the unit, engage in a 
discussion with their manager on the volume and type of offensive material that they have been 
exposed to, and how they have coped or been affected by the exposure. This conversation should 
NOT be aligned with the Performance Management Review and the outcomes NOT indicated in the 
performance assessment. 


Review the protocols, responsibilities and reference materials within the CBSA Intervention 
Protocol for CBSA Employees Who Are Exposed to Offensive Material. 


Prior to accepting work within the DFU, participate in the half-day CBSA training session: Mitigating 
the Impacts of Exposure to Offensive Materials. 


Participate in annual checkups and refresher presentations, as such training is developed and made 
available. 

Be aware of resources and materials that are immediately available prior to, or in the event of 
exposure to offensive materials. Such resources include: pre-checklist, eye patch, reframing 
narrative, Tetris game and the Where's Waldo books, as well as known "mitigation and recovery 
techniques". 


Court Proceedings 


processes. 


Prior to testifying, DFU staff must understand and validate their evidence. DFU staff should rely on 
their training, skills, knowledge and experience in their testimony rather than on the forensic 

software that was used to extract the evidence from the digital devices or media. Software referred 
to as "push-button" software, is particularly of concern, as the DFU staff member must understand 
and be able to clearly articulate the proce 


expert in court is normally only Pre iè the pee pa a = not dee? 


to future legal proceedings. 


| from his personal knowledge of the 
s to testify as to opinioni or 


and experience, haa become aata some sag 
opinions as to relevant and material matter, in whi 
their reasons for the opinion.” 
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Appendix A - Training Report template 


[Event Title] 


Post-Trip Report 


Event attendee: [name] 
[date of event] 


[location of event] 
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i del Canada Border 
M Services Agency 


Presented by [Name] 
Training Date: [Date] 


[Brief outline of event — executive summary] 
Use this section to provide a non-technical executive summary of the training event. 


[Summary of learning] 
Use this section to describe the learning achieved or talks and presentations attended. 


[Relevance to your position] 
Discuss how this event was relevant to your current duties or how this has helped in scope of your 
duties. 


[Course Recommendation] 
Provide feedback on the overall aspect of the course and if you would recommend the course. Please 
include the reasons for your recommendation. 


Submitted by: [Name] 
[Unit] 
[Date] 
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Appendix B - Forensic Lab Equipment 


tions and chairs are required for the varied types of digital forensic 


ufficient power requirements and power outlets that include at least one 30 amp outlet. 
e Proper ventilation to accommodate the number of computers and devices anticipated to be 
installed geleef three to hum Ripe p DFU qm m 


xim 


read/write drives; and a minimum of two DE creen 

e Secondary desktop computer capable of running epu snd an Unix Kanenn systems, 
with a minimum of two high capacity hard drives, one DVD read/write drive, one large screen (24” 
or larger) 

e Laptop computer capable of running Windows or Macintosh operating system, with a minimum of 
two high capacity hard drives, one DVD read/write drive and sufficient modern output 
connections for high speed data transfer and digital de connection. 

e Uninterruptable power supply unit capable of powering a minimum of 3000VA for 10-15 minutes. 

H large: capacity external disk drive array of sufficient size to provide data backup for 10 years of | 

e, working files, archived files. This will vary by region and office, but, an estimated 

AOTB of storage is recommended per DFU laboratory. f 
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Appendix C - Request for Examination Form 


| Word ` ` : 
| Processing/Text 
Documents — _ 


| ewa parn > (o 


| 7 SE | Check-wriüng ` TEI 
Email Files | | programs, credit ` | D 
| |earinfo | | [Other- Please be specific] - ` 


Internet = 
‘History & chet | 
Files - 


Canada Border Agence des 
Services Agency frontaliers duc Pana 


Upon completion of forensic examination, evidence items will be secured in the Forensic Lab Evidence Lock-up, pending 
disposition of natter as cable. A detailed report of findings will to subm 9 officer/investigator. 
Evidence from outside agencies will be returned directly to submitting officer 


Notes: 


e Please doN 
backup tapes, 
handling guidelines. 


ice evidence tape directly on CPUs or any other seized media such as floppy disks, 
etc. These items should be bagged and labeled in accordance with evidence 


id as evidence on the computer or electronic media; 
| this form. Please attach additional sheets if 


e Itis important to identify what you expect/hope 
please be as detailed as possible when completi 
necessary. 


+ Please attach a copy of the Port Seizure, CIIMS printout, and / or search warrant, and in addition, a 
copy of your case report / statement of facts. 
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Appendix D - Search Kit List of Items 


D Laptop or forensic processing computer 

LI 

. 'd and formatted 

H external dock PA sk drives 

. ite-blockers — hardware and software 

H cables (for use with ak a 

D mobile device data extraction uni 

D digital camera with media card and spare batteries or charger 

D media card reader 

E ds 

. portable table/work s 

H anti-static mats and wrist straps 

D | a 

e 

Lë A 

. Ds andi DVDs 

D lized removable media SR cards, USB drives, etc.) 

. ) 

. 

. 

6 

. pler and staples, note pads, sticky notes, paper clips, fasteners, 
kers, scissors, envelopes (large and small), labels 

D nce bags/boxes 

H evidence packaging materials (anti-static) 

s latex gloves 


* Please note that this list is not all inclusive 
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Appendix E - Claim to Solicitor-Client Privilege 
Letter to Sheriff 
Date 
Office of the Sheriff (agreed upon with the lawyer) 
Address 


City, Province 
Postal Code 


Re: Computer Seized Pursuant to Customs Act Section 111 Search Warrant (or Section 487, as 
applicable) 


Dear [insert name of Sheriff here]: 


On [insert search date], digital devices or media and digital contents were seized by an officer of the 
Canada Border Services Agency from [insert the CBSA Investigations office doing the search] pursuant 
to a search warrant issued by [insert name of justice]. 


Contents of the above-mentioned digital devices or media were the subject of a solicitor-client privilege 
claim pursuant to section 488.1 of the Criminal Code and the digital devices or media and their contents 
were placed into the custody of your office on [insert the date that the evidence was put in the Sheriff's 
trust]. l 
Due to the fragile nature of digital media, safeguards, which exceed the needs of other physical forms of 
evidence, should be adhered to. These special precautions will need to be taken to ensure that the 
original media is preserved and protected from both physical and electronic hazards. 


The Canada Border Services Agency's Criminal Investigations Division has on staff, Digital Forensic 
Unit (DFU) staff that are trained in digital forensic examination and investigation. These DFU 

employees have the knowledge, expertise, computer hardware, and software necess: 
seized digital evidence is preserved in its original state. These DFU employees are av: 


that 
dvise 


media referred to above. 


It is the p 


licy of the Canada Border Services Agency to have DFU staff make a copy or backup of a 


digital de or media, as soon as practically possible, following a seizure action. The copy or backup is 
then used: 


+ to provide a copy to the person from whom it was seized should they request a copy, 


+ for analysis/processing by the Canada Border Services Agency 
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t dida or Sree ly an employee WËSCH in segete fh orensic examination or investigation 
should access seized digital devices or media). In the for a copy of the seized digital 
device or media has not been created, because of the solicitor-client privilege claim. 


data may be easily altered or damaged, the Canada Border Services Agency requests 
the fc llowing - with respect to any i tion (turning a digital device on), examination or copying of 
data or information stored on the seized digital device or media, while it is under your custody: | 


m whom the digital device or media was seized apply under Section 488.1(9) of the l | 
ine documents or files on the seized devices or mec em hata nada Border | 


Should the person fro! 
Criminal Code to e: 


, 


i - ioi ge. 
xuld the person from whan the digi y sexed apply under section 488.1(9) of the 
| Code to make a copy of the seized device or media, that a DFU staff member of the Canada 
rvices Agency be requested to carry out the duplication process under your control. 


The assistance offered and the requests made above are done with an aim to ensuring the integrity of the 
original seized digital evidence for the mutual benefit of all parties. 


Should you require the assistance of a Canada Border Services Agency DFU staff member, please 
contact [insert the name of the Investigator] at [insert the telephone number of the Investigator]. 


Sincerely, 
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c) items describe 
that may be unigı 
or in draft foi 

past instant mes 
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iragraph (a) in digital or electronic format, as well as documents/re ords 

ly digital o t [ 

and records (i h 

aging or online chat ar or oth D 

or other gt device or media storage | 
S used or capable of being used to 


f) possent. 


[Include limiting parameters such as persons, dates, products, vendors and/or countries involved] 
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Appendix G - Attachment C - Grounds for Belief - Computer Search 


Attachment C - Grounds for Belief - Computer Search 
[Insert these paragraphs at the end of the Information to Obtain...] 


us On _{date}_, | spoke with. _{DFU member) , who is a member of the Digital Forensic Unit 
L igations Section within the Canada Border Services Agency 
(CBSA). (DFU member) is trained in the forensic search, analysis, extraction and 
preservation of digital data from digital devices and media and as such is aware of the 
following: 


i) Members of the DFU can forensically examine digital devices and media to retrieve 
information from tt wier is typically stored on memory chips or traditional hard 
dri ined ji ice, although manufacturers may also e 
other types of storage. To sonaue a comprehensive search, the forensic examination 
will include searching all data storage areas within a device for the “Things to be 
searched for” in Attachment A. 


ii) The data searched for typically includes, but is not limited to, the following: 

i. Documents and spreadsheets, such as business records; 

ii Email messages, instant messages, and other stored communications; 
Web pages, either created on the media or downloaded from the world wide 
web; 
Database files and other specialized files such as those used by accounting 
software. 
iii) Digital data deleted by a user is not immediately erased. Rather, that space is 


marked by the device as available for reuse. If this area is not reused prior to 
seizure, digital forensic tools may be able to retrieve the deleted information. 
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iv) Metadata is data about data. Metadata can be created by a user or may be 
automatically generated without any involvement or initiation by the user. Examples 
of metadata include, but are not limited to the following: 


i. times and dates relating to the creation, deletion or modification of data; 
ii mapping coordinates of a photograph; 
ii. user identification relating to the creation of data or device settings; 
iv. connecth formation related to the insertion, attachment or connection of 


the device to other devices and networks; 
v. times and dates related to device start-up, shut-down, and user log-in and log- 
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out; 
vi. on-line history and software program usage. 


v) Data saved on a digital device can be hidden from casual e; ation by me 
variety of techniques. Even novice users may make | these ies, 
Password protection, encryption or security may make cursory on-site searching 
SIRYA or — 


inde ^ e searched for in Brea A, as grr as the use, 
ownership. i possession and maintenance of these digital devices and media. 


available data, the DFU member will, where possible, create a 
an exact duplicate of every bit of data available to the imaging 
imaging of digital devices and media may be completed at the place to 
be searched. However, where this is not possible or practical, the original digital 
devices and media will be seized and be imaged off-site. To access such data or 
render it intell ible, Ls member d dad) to weie in a Keralen en onment 
og he 
FU member will, where possible, ensure that Cé oficina) data remains ad 
during the imaging process. 


viii)Based on the above processes, the DFU member will determine the reasonableness 
and necessity of asking anyone on the premises with knowledge of passwords or 
encryption keys required for accessing any digital device or media, to divulge that 
information to them. The DFU member will also determine whether it is reasonable 
and necessary to seize additional device peripherals or software required for 
accessing or controlling data within any seized digital devices and media. 


ix) The preceding discussion has focussed on computer hard drives, however, the 
inci les L aT apply erer to al digital beige? and media, Wee bang pi 


to be Sea for" in Attachment Aas dente) in de judicially habag wegen 
to Search. 


The following 2 paragraphs may be us 
these paragraphs if you intend to use an: QN. bere ie iios data to be U or 
if applying for an Assistance Order. Please discuss with your DFI and Manager. 
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Pursuant to Subsection 487(2.1) of the de, any person authorized by this section 
to search a computer system or other electronic device or media in a building or place for 
data may: 
a. use or cause to be used any computer system at the building or place to search any 
data contained in or available to 'omputer system; 
b. reproduce or cause to be reproduced any data in the form of a print-out or other 
int — M ec 


data. 


bendi to Sahseoton N ede of Weg Gorete ue and with 
fi a, 


e person eebe omg n. sea n 
ie be due any computer system at 
1 or available to the coi 
zed D to search for, 
hard copy of the data and seize it: and 


the warant, pen 
a. to use or ci e building or place in order to 


uter system for data that the 


c. toi use or cause to be used any copying equipment at the place to make copies of 
the data. 
(Use paragraphs 1 and 2 with Criminal Code Warrants only) 
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Effective Date 


l. This policy takes effect on April 1, 2016. 


Policy Statement 


2. Itis the policy of tl 


CBSA to provide court-recog , extract, document, analyze 


and preserve digital evidence in support of the CI 1um and its criminal 
enforcement mandate. 
Policy Objective 


3. The objective of this policy is to provide direction to Enforcement and Intelligence (E&I and 
management responsible for digital forensic examinations to ensure consistency, accountability and that 
activities are lawfully conducted. 


Application 


4. This policy applies to E&I staff involved in any degree with handling or conducting digital forensic 
examinations of digital devices and media during the course of conducting a criminal investigation, and 
the managers and directors of those staff. 


es and media will do so in accordance 
lard Operating Procedures. 


6. This policy does not apply to Border Services Officers, staff within CBSA Science and Engineering, or 
other CBSA staff who may conduct examinations of digital devices and media for their own program 
purposes. 


Definitions 


7. E&I Staff - For the purpose of this policy refers to E&I staff who conduct digital forensic examinations 
of digital devices and media in the context of digital forensic investigations. 


8. Digital Forensic Investigations - The identification, extraction, analysis and preservation of material 
found in digital devices for evidentiary purposes. 


9. Digital Devices - An electronic device that is capable of receiving, storing, processing or sending digital 
information. 


10. Media - Data storage material divided into four broad categories according to the € 
Magnetic, such as diskettes, disks, tapes, (2 
CDs and DVDs, and (4) peripheral storage such as hard dis 


method: (1) 


11. Metadata — Underlying information, definition or description of one or more aspects of the data; or data 
about the data. (ie GPS coordinates of a photograph) 
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12. Goods — "goods", for greater certainty, includes conveyances, animals and any document in any form 


(Customs Act S.2(1)) 


13. Documents — means any medium on which is recorded or marked anything that is capable of being read 
or understood by a person or a computer system or other device. (Criminal Code S. 487.011) 


Authorities 


General 


ligital devices and media stems from various lawful authorities that 


14. Authority for the CBSA to exam 
11 tigation as an investigative technique to enable enforcement of 


permit the use of dig 
CBSA program legislation. 


Customs Act 
15. Section 111 (1) Information for search warrant- A justice of the | peace who is satisfied Tris information 


on oath in the form set out as Form 1 in Part XXVIII of the Criminal Cod 
there are reasonable grounds to believe that there will be found in a bu 


ce e: 
suspected of having been contravened, 


(b) any conveyance that has been made use of in respect of such goods, whether at or after the time of the 


(c) anything that there are reasonable grounds to believe will afford evidence in respect of a 
contravention of this Act or the regulations, 


may at any time issue a warrant under his hand authorizing an officer to search the building, receptacle or 
place for any such thing and to seize it. 


16. Section 111 (3) Seizure of things not specified - An officer who executes a warrant issued under 


subsection (1) may seize, in addition to the things mentioned in the warra: 


by 


(a) any goods or conveyance in respect of which the officer believes on reasonable grounds that this Act 
or the regulations have been contravened; 


(b) any conveyance that the officer believes on reasonable grounds was made use of in respect of such 
goods, whether at or after the time of the contravention; or 


(c) anything that the officer believes on reasonable grounds will afford evidence in respect of a 


contravention of this Act or the regulations. 
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| 18. Section 112 Powers of entry - For the purpose of exercising his authority under section 111, an officer 
y, with such assistance as he deems necessary, break open any door, window, lock, fastener, floor, wall 
ceiling, compartment, plumbing fixture, box, container or any other thing. 


Criminal Code 


19. Section 487 (1) Information for search warrant - A justice who is satisfied by information on oath in 

Form | that there are reasonable grounds to believe that there is in a building, receptac 

(a) anything on or in respect of which any offence against this Act or any other Act of Parliament has 
been or is suspected to have been committed, 


(b) anything that there are reasonable grounds to believe will afford evidence with respect to the 
commission of an offence, or will reveal the whereabouts of a person who is believed to have 
committed an offence, against this Act or any other Act of Parliament, 


(c) anything that there are reasonable grounds to believe is intended to be used for the purpose of 
committing any offence against the person for which a person may be arrested without warrant, or 


(c.1) any offence-related property, 
may at any time issue a warrant authorizing a peace officer or a public officer who has been appointed or 


designated to administer or enforce a federal or provincial law and whose duties include the enforcement 
ofthis Act or any other Act of Parliament and who is named in the warrant 


(d) to search the building, receptacle or place for any such thing and to seize it, and 
| (e) subject to any other Act of Parliament, to, as soon as practicable, bring the thing seized before, or 
make a report in respect thereof to, the justice or some other justice for the same territorial division in 
accordance with section 489.1. 


20. Section 487 (2.1) Operation of computer system and copying equipment - A person authorized under 
this section to search a computer system in a building or place for data may 


(a) use or cause to be used any computer system at the building or place to search any data contained in 
or available to the computer system; 


(b) reproduce or cause to be reproduced any data in the form of a print-out or other intelligible output; 
(c) seize the print-out or other output for examination or copying; and 
(d) use or cause to be used any copying equipment at the place to make copies of the data. 
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. Section 487 (2.2) Duty of person in possession or control - Every person who is in possession or 
control of any building or place in respect of which a search is carried out under this section shall, on 
presentation of the warrant, permit the person carrying out the search 


(a) to use or caused to be used any computer system at the building or place in order to search any data 
contained in or available to the computer system for data that the person is authorized by this section 
to search for, 
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(b) to obtain a hard copy of the data and to seize it, and 


(c) to use or cause to be used any copying equipment at the place to make copies of the data. 
Policy Guidelines 


General 


22. E&I staff shall be trained to meet CBSA nationally defined training standards. (see National Training 
Standards) 


il devices and media shall be based on Criminal 
ies. 


23. Prioritization of digital forensic examinations of digi 
Investigations’, and Enforcement and Intelligence pr 


24. Requests for assistance with conducting examinations of digital devices and media received from, or sent 
to other CBSA areas, or l law enforcement partners shall only be actioned when legislation or 
regulatory authorities per Prior to initiating an examination when providing assistance to other CBSA 
areas, or external law enforcement partners, Director/Assistant Director level approval is required to 
ensure alignment with priorities, legal authorities, and proper resource management. 


2 


Lë 


. E&I staff shall be cognizant of the higher expectations of privacy that apply to the examination and 
retrieval of information found on these devices. Additional judicial authorization may be required to 
access, review and/or seize information contained within system generated metadata, and deleted files. 


26. Laboratories in which digital forensic examinations are conducted, and in which digital evidence is stored 
must be constructed and secured in accordance with the CBSA Comptrollership Manual, and Criminal 
Investigations’ policy regarding the control and safeguarding of evidence and evidence rooms. 


27. Access to the laboratory where digital forensic examinations of devices and media are conducted shall be 
_ limited to E&I staff who conduct examinations of digital devices and media; regional managers, and 
Investigators for the purpose of reviewing electronic evidence. 


Criminal Investigations and Digital Forensic Examinations 


28. Digital devices and media, along with digital documents and software, continue to be classified as 
“goods” in the border context during regulatory processing and assisting other CBSA officers. Prior to 
discovering any grounds to suspect that a criminal offence may have been committed, carefi 
consideration should be afforded to the breadth and depth of the examination given the high volume of 
personal data, and higher expectation of privacy associated with these devices. 


“examination pha a riri shall mak a search — mier ie Sege Dem en of that 
device. 


30. An arrested person has the right to remain silent and therefore is not legally obligated to provide 
passwords, passphrases or decryption keys that would enable access to a digital device or media. 


31. Persons are not legally obligated to provide passwords, passphrases or decryption keys for digital devices 
and media that are seized during execution of a search warrant that would enable access to those devices 
or media. 
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Roles and Responsibilities 
Operations Branch, Enforcement and Intelligence (Headquarters) 
Director General-Headquarters 

32. Responsibilities: 

a) Ensuring adherence to this policy and standard operating procedures; 


b) Ensuring performance reporting is conducted in accordance with the performance measurement 
framework. 


Directors - Headquarters 
33. Responsibilities: 


a) Ensuring adherence to this policy and standard operating procedures; 


b) Er erformance reporting is conducted in accordance with the perform: 


Managers - Headquarters 
34. Responsibilities: 
a) Ensuring adherence to this policy and standard operating procedures; 


b) Directing and monitoring performance reporting in accordance with the performance measurement 
framework; 


Approving and disseminating communications and bulletins associated with digital forensic 
investigations. 


= 
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National Digital Forensic Investigations Coordinator - Headquarters 
35. Responsibilities: 
a) Developing and maintaining standard operating procedures; 
b) Adhering to this policy and the standard operating procedures; 


c) Communicating expectations and monitoring of performance reporting; 
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e) Consulting and advising E&I managers and staff, and liaising with internal and external stakeholders and 
law enforcement partners; 


and monitoring annual operating and maintenance (O&M) forecasts and budgets, including 
bursements and allocation of regional training budgets for E&I staff; 


g) Defining lab and equipment standards; 


h) Researching and testing equipment, and coordinating its acquisition and distribution nationally, in 
shared Services Canada, CBSA Science and Engineering and CBSA IT as required; 


i) Maintaining and auditing inventory of all equipment and licenses (assets) acquired for the digital forensic 
program nationally; 


j Monitoring and maintaining work descriptions and classifications for E&I staff, in consultation with 
Programs Branch and Human Resources; 


k) De ing and dissem 


E ing communications and bulletins associated with digital forensic 
investigations. 


Operations Branch, Enforcement and Intelligence (Regions) 
Regional Directors General - Regions 
36. Responsibilities: 
a) Ensuring adherence to this policy and standard operating procedures. 
Directors - Regions 
37. Responsibilities: 
a) Ensuring adherence to this policy and standard operating procedures: 
Directors/Assistant Directors - Regions | 
a) Ensuring adherence to this policy and standard operating procedures; 
b) Reviewing requests for assistance to examine digital devices and media received from other CBSA areas, 
and external law enforcement, and approving or refusing such requests based on legislative authorities, 
Enforcement and Intelligence priorities, resources, and Agency mandate; 


c) Considering all requests for training from E&I staff, in consideration of national training standards; 


d) Ensuring E&I staff have readily available access to properly equipped laboratories and equipment 
necessary to conduct examinations in safe and secure working environments. 


38. Responsibi 
a) Ensuring adherence to this policy and standard operating procedures, 
b) Ensuring performance reporting is completed: 


c) Ensuring that laboratories and equipment used to conduct digital forensic examination, meet equipment 
standards as per the standard operating procedures, 


d) Ensuring that only E&I staff who have completed the required training and learning in accordance with 
national training standards, are permitted to conduct digital forensic examinations of digital devices and 
media, 


i 3, making recommendations and referring all requests fo 
ed media received from other CBSA areas and external partners, to 


ince to examine digital devices 
the Director; 


f) Ensuring E&I staff are consulted during all stages of search warrants. 


innual meetings with E&I staff who are exposed to offensive materials, and offering 
assistance or other support as required. 


Enforcement and Intelligence Staff Conducting Digital Forensic Investigations - Regions 


39. Responsibilities: 


a) Adhering to this policy and standard operating procedures; 


authorities and j dence in relation to the examination and search of digital evidence; 


€) Informing management of any assistance requests received, and seeking management approval prior to 
providing assistance; 


f Ensuring laboratories where di forensic examinations are conducted remain safe and secure working 
at evidence, equipment, sensitive material, documents, and manuals are stored in 
accordance with policy and standard operating procedures. 


Programs Branch, Enforcement and Intelligence (Headquarters) 


Director General - Headquarters 


40. Responsibilities: 
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formation. 


c) Establishing and provi sti 
examinations of digital devi. 


Directors - Headquarters 
41. Responsibilities: 


a) Ensuring development of policy regarding digital forensic examinations of digital devices and media; 


b) Establishing a performance measurement framework to collect statistics and metrics related conducting 
examinations of digital devices and media; 


trategic direction, and program priorities in relation to conducting 
examinations of digital devices and media. 


Managers - Headquarters 
42. Responsibilities: 


a) Developing policy regarding examinations of digital devices and media; 


tion of established strategic direction and program priorities in relation to conducting 
gital devices and media; 


c) Establishing a performance measurement framework for examinations of digital devices and media. 
Senior Program Advisors - Headquarters 


43. Responsibilities: 


a) Developing and managing policies related to digital forensic investigations; 


b) Working with Operations Branch and Training and Development Directorate to recommend, establish, 
implement and monitor national training standards; 


c) Establishing a performance measurement Framework for examinations of digital devices and media; 


d) Developing work descriptions and classifications in collaboration with Operations Branch and Human 
Resources. 


ivi Canada Border Agence des services 
Jui Services Agency frontaliers du Canada 


OPERATIONAL BULLETIN: 


Examination of Digital Devices and Media at the Port of Entry - 


] Mode(s): 
All 


Details: | 


in is to provide interim guidance on a 
ital devices or media at ports of entry. 


Target Audience: | Area of Interest: | 
National Port of Entry 


e The purpose of this operational bull 
CBSA officer's authority to examine 
Clarification will be provided on w 
performed, and will explain limit 


: ch examinations should and can be 
ions to these authorities. 


Authorities: 


Digital devices and media, along with digital documents and wp 
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the Immigration and EES Protection 
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e Subsection 139(1) of the IRPA allows for the search of digital devices and 
media at the p f entry where there are reasonable grounds to believe that 
the person has revealed the ntity or has hidden, on or about their 
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pem they examine may reasonably be expected to 
ni . The officer's notes shall clearly articulate the 
types of data they examined, and their reason for doing so. 
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CBSA officers should advise travellers that they are not required to access or 


provide external information, but may voluntarily choose to do so. The login 
information or password shall not be compelled or recorded in these cases. 


e Ifa traveller refuses to provide a password to allow examination of the digital 
device, media or the documents contained therein, or if there are technical 
difficulties that prevent a CBSA officer from examining the digital device or 
media, the device or media may be detained by the CBSA officer under the 
authority of Section 101 of the Customs Act, on the form K26, Notice of 
Detention, for examination by a CBSA expert trained in digital forensic 
examinations. For IRPA-related examinations, the device or media may be 
detained under the authority of subsection 140 (1) of the IRPA on the form 
IMM5265. 


e Until further instructions are issued, CBSA officers shall not arrest a traveller 
for hindering (Section 153.1 of the Customs Act) or for obstruction (paragraph 
129(1)(d) of IRPA) solely for refusing to provide a password. Though such 
actions appear to be legally supported, a restrained approach will be adopted 
until the matter is settled in ongoing court proceedings. 


+ At the conclusion of a non-resultant examination, the traveller shall be advised 
that though their password will be protected in accordance with privacy laws, 
they may nonetheless change it if they wish to do so. 


Contact Information: 
Program Compliance and Outreach Division, Traveller Programs Directorate 


If you have any further questions, please forward them through the regional 
Corporate and Program Services Divisions, which (if required) will then send an email 
to the Port of Entry Operations' generic inbox: CBSA-ASFC Ops Travellers- 
Voyageurs. 


Approved by: Barry Kong, Director 
Programs Compliance and Outreach Division 
Traveller Programs Directorate 
Programs Branch 

Effective Date: 2015-XX-XX | Updated: N/A 


Additional bulletins: http://atlas/ob-dgo/bso-asf/bulletin/index_eng.asp 
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